80c31b93b57a755b509f2ccc4152dbd825e6829eea8675fe18d02948f42bfbda

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/06/2024, 00:11

Target
saturnbootsrapper.exe
Size 52.2MB
Sample240604-agrsxaec4x
SHA256 80c31b93b57a755b509f2ccc4152dbd825e6829eea8675fe18d02948f42bfbda
MD5 a9e1bc56479e53b1836459e9a9e5c551
SHA1 93cdd7964cdbaede24f958d7030d1f6906708a4b
SHA512 0a266e6908916e6a4aa86800dc55a724fcbac64df211cf127d7c0de3db511438ad543954875c4db0cad0732bf69885019799c19b3b6bf9fc2d8de0ebfca4be0e
SSDEEP 393216:uWvz+q3VyoyUIC9urEUWj5EnBSVkRIrY87FNlqrMvxmouin93vt6a9kW/W:Pz+q30QdbQzcY87FziMZmylV6BM
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
3048	saturnbootsrapper.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000500000001a451-103.dat	upx
behavioral1/memory/3048-105-0x000007FEF5510000-0x000007FEF5BD5000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 856 wrote to memory of 3048	856	saturnbootsrapper.exe	28
PID 856 wrote to memory of 3048	856	saturnbootsrapper.exe	28
PID 856 wrote to memory of 3048	856	saturnbootsrapper.exe	28

C:\Users\Admin\AppData\Local\Temp\saturnbootsrapper.exe
"C:\Users\Admin\AppData\Local\Temp\saturnbootsrapper.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:856
- C:\Users\Admin\AppData\Local\Temp\saturnbootsrapper.exe
  "C:\Users\Admin\AppData\Local\Temp\saturnbootsrapper.exe"
  2⤵
  - Loads dropped DLL
  PID:3048

python312.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI8562\python312.dll
Size 1.7MB
SHA256 cb627a3c89de8e114c95bda70e9e75c73310eb8af6cf3a937b1e3678c8f525b6
MD5 fb8bedf8440eb432c9f3587b8114abc0
SHA1 136bb4dd38a7f6cb3e2613910607131c97674f7c
SHA512 b632235d5f60370efa23f8c50170a8ac569ba3705ec3d515efcad14009e0641649ab0f2139f06868024d929defffffefb352bd2516e8cd084e11557b31e95a63
SSDEEP 49152:xm7u77uID/cZXnJ4Ph3tLm82R8PeDCemJ:Y7uJcZX6pumfJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3048-105-0x000007FEF5510000-0x000007FEF5BD5000-memory.dmp

Download